CVE-2026-12079

Name of the Vulnerable Software and Affected Versions Dokan Pro versions prior to 5.0.5

Description The Dokan Pro plugin for WordPress contains a time-based SQL Injection flaw. This occurs because the software does not sufficiently escape user-supplied input or properly prepare the SQL query. Authenticated attackers with Subscriber-level access or higher can exploit this by appending malicious SQL queries via the orderby parameter to extract sensitive information from the database.

Recommendations Update Dokan Pro to a version newer than 5.0.4. As a temporary mitigation, restrict access to the orderby parameter for users with Subscriber-level permissions.